ebpf-mcp

What it does

Connects AI assistants to the Linux kernel via eBPF, allowing for real-time system observability, program loading, and event streaming without shell escapes.

Tools

• info: Get kernel version, architecture, and BTF status.
• load_program: Load and validate eBPF .o files (CO-RE supported).
• attach_program: Attach programs to XDP, kprobes, or tracepoints.
• inspect_state: List active eBPF programs, maps, and links.
• stream_events: Real-time event streaming from ringbuf/perfbuf maps.
• trace_errors: Monitor kernel tracepoints for errors.

Installation

Run the following to install the server on your Linux host:

curl -fsSL https://raw.githubusercontent.com/sameehj/ebpf-mcp/main/install.sh | sudo bash
sudo systemctl start ebpf-mcp

Then add the HTTP server to your MCP client:

{
  "mcpServers": {
    "ebpf": {
      "url": "http://localhost:8080/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}

Supported hosts

• Claude Desktop
• Cursor
• Gemini-CLI